Merge branch '0.9.x'

[quix0rs-gnu-social.git] / lib / apioauth.php

diff --git a/lib/apioauth.php b/lib/apioauth.php
index 4cb8a677541d223b096522f63979e91b959f5fa2..54cecf92a8dca80d27588478f0342309c24946b6 100644 (file)
--- a/lib/apioauth.php
+++ b/lib/apioauth.php
@@ -30,13 +30,12 @@
 if (!defined('STATUSNET')) {
     exit(1);
 }
-
+require_once INSTALLDIR . '/lib/apiaction.php';
 require_once INSTALLDIR . '/lib/apioauthstore.php';
 
 /**
- * Base action for API OAuth enpoints.  Clean up the
- * the request, and possibly some other common things
- * here.
+ * Base action for API OAuth enpoints. Clean up the
+ * request. Some other common functions.
  *
  * @category API
  * @package  StatusNet
@@ -44,15 +43,13 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link     http://status.net/
  */
-
-class ApiOauthAction extends Action
+class ApiOauthAction extends ApiAction
 {
     /**
      * Is this a read-only action?
      *
      * @return boolean false
      */
-
     function isReadOnly($args)
     {
         return false;
@@ -73,50 +70,40 @@ class ApiOauthAction extends Action
      *
      * @return void
      */
-
     function handle($args)
     {
         parent::handle($args);
         self::cleanRequest();
     }
 
+    /*
+     * Clean up the request so the OAuth library doesn't find
+     * any extra parameters or anything else it's not expecting.
+     * I'm looking at you, p parameter.
+     */
+
     static function cleanRequest()
     {
         // kill evil effects of magical slashing
-
         if (get_magic_quotes_gpc() == 1) {
             $_POST = array_map('stripslashes', $_POST);
             $_GET = array_map('stripslashes', $_GET);
         }
 
         // strip out the p param added in index.php
-
-        // XXX: should we strip anything else?  Or alternatively
-        // only allow a known list of params?
-
         unset($_GET['p']);
         unset($_POST['p']);
-    }
+        unset($_REQUEST['p']);
 
-    function getCallback($url, $params)
-    {
-        foreach ($params as $k => $v) {
-            $url = $this->appendQueryVar($url,
-                                         OAuthUtil::urlencode_rfc3986($k),
-                                         OAuthUtil::urlencode_rfc3986($v));
-        }
+        $queryArray = explode('&', $_SERVER['QUERY_STRING']);
 
-        return $url;
-    }
-
-    function appendQueryVar($url, $k, $v) {
-        $url = preg_replace('/(.*)(\?|&)' . $k . '=[^&]+?(&)(.*)/i', '$1$2$4', $url . '&');
-        $url = substr($url, 0, -1);
-        if (strpos($url, '?') === false) {
-            return ($url . '?' . $k . '=' . $v);
-        } else {
-            return ($url . '&' . $k . '=' . $v);
+        for ($i = 0; $i < sizeof($queryArray); $i++) {
+            if (substr($queryArray[$i], 0, 2) == 'p=') {
+                unset($queryArray[$i]);
+            }
         }
+
+        $_SERVER['QUERY_STRING'] = implode('&', $queryArray);
     }
 
 }